release.yml

name: release

on:
  push:
    tags:
      - 'v*'
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: write
  packages: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  REPO: rossoctl/operator
  CHARTS_PATH: ./charts

jobs:
  # Build the two images in parallel, one matrix instance per image.
  # Each instance carries its own buildx cache scope so warm builds
  # only re-pull what changed for that image.
  build-and-push:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image_config:
          - name: rossoctl-operator
            context: ./operator
            dockerfile: ./operator/Dockerfile
          - name: agentcard-signer
            context: ./operator
            dockerfile: ./operator/cmd/agentcard-signer/Dockerfile
    steps:
    - name: Checkout
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

    - name: Set up QEMU
      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4

    - name: Log in to ghcr.io
      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract Docker metadata
      id: meta
      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6
      with:
        images: ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.image_config.name }}
        tags: |
          type=sha,prefix={{branch}}-,enable={{is_default_branch}}
          type=raw,value=latest,enable={{is_default_branch}}
          type=semver,pattern={{version}}

    - name: Build and push ${{ matrix.image_config.name }}
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7
      with:
        context: ${{ matrix.image_config.context }}
        file: ${{ matrix.image_config.dockerfile }}
        push: true
        platforms: linux/amd64,linux/arm64
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        # GitHub Actions cache, scoped per image so the two parallel
        # matrix jobs don't trample each other.
        cache-from: type=gha,scope=${{ matrix.image_config.name }}
        cache-to: type=gha,mode=max,scope=${{ matrix.image_config.name }}

  # Release-only steps (helm chart packaging + GitHub Release). Runs
  # once after both image builds complete, only on tag pushes.
  release:
    needs: build-and-push
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

    - name: Set up Helm
      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310  # v5.0.1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Install yq
      uses: mikefarah/yq@1b9b4ac5187171d2e5e3129be0cfa827c7f9d53d  # v4

    - name: Log in to ghcr.io
      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Package and push Helm chart
      run: |
        chartVersion=$(echo "${{ github.ref_name }}" | cut -c 2-)
        chartPackageName="operator-chart-${chartVersion}.tgz"
        cd ${{ env.CHARTS_PATH }}/operator
        yq -i '.controllerManager.container.image.tag = strenv(chartVersion)' values.yaml
        yq -i '.controllerManager.container.image.pullPolicy = "IfNotPresent"' values.yaml
        helm package . --destination . --version "${chartVersion}" --app-version "${chartVersion}"
        helm push "./${chartPackageName}" oci://${{ env.REGISTRY }}/${{ env.REPO }}

    - name: Create GitHub Release
      run: |
        # Idempotent: the release may have been pre-created out of band
        # (e.g., a maintainer ran `gh release create` before pushing the
        # tag for custom notes). Use `gh release view` to short-circuit
        # rather than grepping stderr from `gh release create` — that
        # text is locale-dependent and a moving target across gh
        # versions.
        if gh release view "${{ github.ref_name }}" >/dev/null 2>&1; then
          echo "Release ${{ github.ref_name }} already exists; skipping create."
        else
          gh release create "${{ github.ref_name }}" --generate-notes
        fi
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  e2e-helm-install:
    needs: build-and-push
    if: github.ref_type != 'tag'
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

    - name: Create Kind cluster
      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc  # v1

    - name: Install cert-manager
      run: |
        kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.2/cert-manager.yaml
        kubectl -n cert-manager rollout status deployment/cert-manager --timeout=90s
        kubectl -n cert-manager rollout status deployment/cert-manager-webhook --timeout=90s
        kubectl -n cert-manager rollout status deployment/cert-manager-cainjector --timeout=90s

    - name: Install Helm chart
      # The chart's values.yaml ships with `tag: __PLACEHOLDER__`, which
      # the release job substitutes only on tag pushes. On main pushes
      # we override to `:latest` (which the build-and-push job just
      # tagged) so the rendered Deployment can actually pull an image.
      run: |
        helm install rossoctl-operator ./charts/operator \
          --set controllerManager.container.image.tag=latest

    - name: Wait for deployment rollout
      run: |
        kubectl rollout status deployment/rossoctl-controller-manager \
          --timeout=120s

    - name: Verify operator pod is Running and Ready
      run: |
        kubectl wait pods \
          -l control-plane=controller-manager \
          --for=condition=Ready \
          --timeout=60s
        kubectl get pods -l control-plane=controller-manager